Analysis

  • max time kernel
    117s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    17-07-2020 18:07

General

  • Target

    a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1.exe

  • Size

    276KB

  • MD5

    bf2262b8632a5f208be9a86f2b7726bc

  • SHA1

    14a07c45d389cfa7d6a2f4c77550e8269dd639c0

  • SHA256

    a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1

  • SHA512

    882bf8cf4a064f19b3377b98764bdaea679944e3efe0f23334d1d8b616c04f90004bd4e9e45506cdfc79e693dd644cdafd4826627af91fd367bc2a779d125f71

Score
10/10

Malware Config

Extracted

Family

emotet

C2

177.144.130.105:443

198.27.69.201:8080

157.7.164.178:8081

78.188.170.128:80

203.153.216.178:7080

77.74.78.80:443

178.33.167.120:8080

177.0.241.28:80

143.95.101.72:8080

51.38.201.19:7080

181.167.35.84:80

41.185.29.128:8080

192.163.221.191:8080

181.164.110.7:80

203.153.216.182:7080

80.211.32.88:8080

113.160.180.109:80

185.142.236.163:443

192.241.220.183:8080

87.106.231.60:8080

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
3
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
4
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB
5
-----END PUBLIC KEY-----
6

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: EmotetMutantsSpam 1 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1.exe
    "C:\Users\Admin\AppData\Local\Temp\a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: EmotetMutantsSpam
    PID:1492

Network

  • flag-unknown
    POST
    http://177.144.130.105:443/pRFJEshSW21xzy/hGI5XI1aS/3xlyg/VaajApR0/bNucHN1ulTbM4l/
    a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1.exe
    Remote address:
    177.144.130.105:443
    Request
    POST /pRFJEshSW21xzy/hGI5XI1aS/3xlyg/VaajApR0/bNucHN1ulTbM4l/ HTTP/1.1
    Referer: http://177.144.130.105/pRFJEshSW21xzy/hGI5XI1aS/3xlyg/VaajApR0/bNucHN1ulTbM4l/
    Content-Type: multipart/form-data; boundary=---------------------------520431936615603
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: 177.144.130.105:443
    Content-Length: 4372
    Connection: Keep-Alive
    Cache-Control: no-cache
  • flag-unknown
    POST
    http://198.27.69.201:8080/GU4YZyGIb/SYUZUxE4J1qb0Wwrda/bYsDJSzV1/z7GDXR9k6cK2I/
    a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1.exe
    Remote address:
    198.27.69.201:8080
    Request
    POST /GU4YZyGIb/SYUZUxE4J1qb0Wwrda/bYsDJSzV1/z7GDXR9k6cK2I/ HTTP/1.1
    Referer: http://198.27.69.201/GU4YZyGIb/SYUZUxE4J1qb0Wwrda/bYsDJSzV1/z7GDXR9k6cK2I/
    Content-Type: multipart/form-data; boundary=---------------------------260799952279960
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: 198.27.69.201:8080
    Content-Length: 4388
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Fri, 17 Jul 2020 18:08:07 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 132
    Connection: keep-alive
  • 177.144.130.105:443
    http://177.144.130.105:443/pRFJEshSW21xzy/hGI5XI1aS/3xlyg/VaajApR0/bNucHN1ulTbM4l/
    http
    a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1.exe
    5.3kB
    212 B
    9
    5

    HTTP Request

    POST http://177.144.130.105:443/pRFJEshSW21xzy/hGI5XI1aS/3xlyg/VaajApR0/bNucHN1ulTbM4l/
  • 198.27.69.201:8080
    http://198.27.69.201:8080/GU4YZyGIb/SYUZUxE4J1qb0Wwrda/bYsDJSzV1/z7GDXR9k6cK2I/
    http
    a8017019674e46eed06e12e55aa42e9c8d776cb780e2991752a22275d300d8a1.exe
    5.7kB
    908 B
    16
    8

    HTTP Request

    POST http://198.27.69.201:8080/GU4YZyGIb/SYUZUxE4J1qb0Wwrda/bYsDJSzV1/z7GDXR9k6cK2I/

    HTTP Response

    200
  • 10.7.0.255:137
    netbios-ns
    312 B
    4
  • 10.7.0.255:138
    netbios-dgm
    458 B
    2
  • 224.0.0.252:5355
    100 B
    2
  • 239.255.255.250:1900
    966 B
    6
  • 239.255.255.250:1900

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1492-0-0x0000000000260000-0x000000000026C000-memory.dmp

    Filesize

    48KB

  • memory/1492-1-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.